How to Detect Who Deleted a Group Policy Object

Group Policy Objects (GPOs) can provide configurations for access to shared resources and devices, enable critical functionalities or establish secure environments. If some of the GPOs are deleted, users may not be able to access the Internet, modify their data, use peripherals or even log in to their systems. Deleting GPOs that deal with access control, authentication and other security policies may increase systems’ vulnerability and allow unauthorized access.

6. To define what group policy was deleted filter Security Event Log for Event ID 4663 (Task Category – “File System” or “Removable Storage”) and search for “Object Name:” string, where you can find the path and GUID of deleted policy and “account name” field contains information about who deleted it.